create-astram-app 0.11.1 → 0.12.1

package/dist/index.js

@@ -4,6 +4,7 @@
  *
  *   npx create-astram-app <name>                    # server/ only
  *   npx create-astram-app <name> --with-frontend     # + frontend/ (identity UI)
+ *   npx create-astram-app <name> --captcha turnstile # CAPTCHA provider in both .env.example files
  *
  * Emits a NEW consumer app directory that depends on the published, immutable
  * framework packages (`@astram/core`, `@astram/guard`, `@astram/sdk`) via real
@@ -68,8 +69,49 @@ export function validateAppName(name) {
     }
     return null;
 }
+/**
+ * CAPTCHA providers the framework supports (server `CAPTCHA_PROVIDER`, frontend build
+ * `VITE_CAPTCHA_PROVIDER`; R7.6, D-10). `none` on the command line means no CAPTCHA.
+ */
+export const CAPTCHA_PROVIDERS = ['turnstile', 'recaptcha-v3', 'recaptcha-v2'];
+const CAPTCHA_FLAG = '--captcha';
+function isCaptchaProvider(value) {
+    return CAPTCHA_PROVIDERS.includes(value);
+}
+/**
+ * Read `--captcha <provider>` / `--captcha=<provider>` from argv. Absent or `none` ⇒ null
+ * (no CAPTCHA, the default). An unknown or missing value is an error.
+ */
+export function parseCaptchaProvider(argv) {
+    let value;
+    let seen = false;
+    argv.forEach((arg, i) => {
+        if (arg === CAPTCHA_FLAG) {
+            seen = true;
+            const next = argv[i + 1];
+            value = next !== undefined && !next.startsWith('--') ? next : undefined;
+        }
+        else if (arg.startsWith(`${CAPTCHA_FLAG}=`)) {
+            seen = true;
+            value = arg.slice(CAPTCHA_FLAG.length + 1);
+        }
+    });
+    if (!seen)
+        return { provider: null };
+    if (value === undefined || value === '') {
+        return { error: `${CAPTCHA_FLAG} needs a value: ${CAPTCHA_PROVIDERS.join(', ')} or none` };
+    }
+    if (value === 'none')
+        return { provider: null };
+    if (!isCaptchaProvider(value)) {
+        return {
+            error: `unknown CAPTCHA provider "${value}"; use one of ${CAPTCHA_PROVIDERS.join(', ')} or none`,
+        };
+    }
+    return { provider: value };
+}
 const USAGE = [
-    'Usage: create-astram-app <name> [--with-frontend]',
+    'Usage: create-astram-app <name> [--with-frontend] [--captcha <provider>]',
     '',
     'Scaffolds a new Astram consumer app that depends on the published framework',
     '(@astram/core, @astram/guard, @astram/sdk) and enforces deny-by-default from',
@@ -77,10 +119,15 @@ const USAGE = [
     '',
     '  --with-frontend   Also scaffold frontend/ (Vite/React identity UI).',
     '                    Without this flag, only server/ is scaffolded.',
+    '  --captcha <p>     CAPTCHA provider for sign-in: turnstile, recaptcha-v3,',
+    '                    recaptcha-v2 or none (default). Writes the same value as',
+    '                    CAPTCHA_PROVIDER (server/.env.example) and',
+    '                    VITE_CAPTCHA_PROVIDER (frontend/.env.example).',
     '',
     'Example:',
     '  npx create-astram-app my-app',
     '  npx create-astram-app my-app --with-frontend',
+    '  npx create-astram-app my-app --with-frontend --captcha turnstile',
 ].join('\n');
 /**
  * Copy a SINGLE template file `srcPath` → `destPath` (never a directory),
@@ -147,6 +194,28 @@ function isTextFile(fileName) {
  * gated: `server/` is always emitted, `frontend/` only with `--with-frontend`.
  */
 const TEMPLATE_SUBTREES = ['server', 'frontend'];
+/**
+ * The one CAPTCHA answer lands in both env files, server `CAPTCHA_PROVIDER` and frontend
+ * `VITE_CAPTCHA_PROVIDER`, so the build's CSP and the server agree (D-10). Each file's commented
+ * template line is replaced by the set value; only files this run wrote are touched (never-clobber).
+ */
+const CAPTCHA_ENV_LINES = [
+    { rel: 'server/.env.example', name: 'CAPTCHA_PROVIDER' },
+    { rel: 'frontend/.env.example', name: 'VITE_CAPTCHA_PROVIDER' },
+];
+function writeCaptchaProvider(targetDir, report, provider) {
+    for (const { rel, name } of CAPTCHA_ENV_LINES) {
+        if (!report.written.includes(rel))
+            continue;
+        const file = join(targetDir, rel);
+        const text = readFileSync(file, 'utf8');
+        const line = new RegExp(`^# ${name}=.*$`, 'm');
+        if (!line.test(text)) {
+            throw new Error(`template ${rel} has no "# ${name}=" line to set`);
+        }
+        writeFileSync(file, text.replace(line, `${name}=${provider}`), 'utf8');
+    }
+}
 /**
  * Scaffold `appName` into `<cwd>/<appName>`. Returns the copy report + resolved
  * target dir. Exported for tests (which pass an explicit `cwd`).
@@ -157,7 +226,11 @@ const TEMPLATE_SUBTREES = ['server', 'frontend'];
  * `server/` and the app-root files (`.astram/guide/`, `CLAUDE.md`, `.gitignore`,
  * `README.md`) are unconditional either way — unchanged from prior behavior.
  */
-export function scaffold(appName, cwd = process.cwd(), withFrontend = false) {
+export function scaffold(appName, cwd = process.cwd(), withFrontend = false, options = {}) {
+    const captchaProvider = options.captchaProvider ?? null;
+    if (captchaProvider !== null && !isCaptchaProvider(captchaProvider)) {
+        throw new Error(`unknown CAPTCHA provider "${String(captchaProvider)}"; use one of ${CAPTCHA_PROVIDERS.join(', ')}`);
+    }
     const targetDir = resolve(cwd, appName);
     const report = { written: [], skipped: [] };
     if (existsSync(targetDir)) {
@@ -201,6 +274,9 @@ export function scaffold(appName, cwd = process.cwd(), withFrontend = false) {
     if (withFrontend) {
         copyTemplate(join(template, 'frontend'), join(targetDir, 'frontend'), appName, report, 'frontend');
     }
+    if (captchaProvider !== null) {
+        writeCaptchaProvider(targetDir, report, captchaProvider);
+    }
     return { targetDir, report };
 }
 /** Long-form boolean flags this CLI recognizes (anywhere in argv). */
@@ -212,12 +288,19 @@ const WITH_FRONTEND_FLAG = '--with-frontend';
  * `create-astram-app my-app --with-frontend` both work).
  */
 function parseAppName(argv) {
-    return argv.find((arg) => !arg.startsWith('--'));
+    // Skip the value that follows a bare `--captcha` (`--captcha turnstile my-app`).
+    return argv.find((arg, i) => !arg.startsWith('--') && argv[i - 1] !== CAPTCHA_FLAG);
 }
 /** Entry point. Returns a process exit code (0 ok, non-zero on error). */
 export function main(argv = process.argv.slice(2)) {
     const name = parseAppName(argv);
     const withFrontend = argv.includes(WITH_FRONTEND_FLAG);
+    const captcha = parseCaptchaProvider(argv);
+    if ('error' in captcha) {
+        console.error(`create-astram-app: ${captcha.error}\n`);
+        console.error(USAGE);
+        return 1;
+    }
     const validationError = validateAppName(name);
     if (validationError) {
         console.error(`create-astram-app: ${validationError}\n`);
@@ -227,7 +310,9 @@ export function main(argv = process.argv.slice(2)) {
     const appName = name.trim();
     let report;
     try {
-        ({ report } = scaffold(appName, process.cwd(), withFrontend));
+        ({ report } = scaffold(appName, process.cwd(), withFrontend, {
+            captchaProvider: captcha.provider,
+        }));
     }
     catch (err) {
         console.error(`create-astram-app: ${err.message}`);
@@ -260,6 +345,15 @@ export function main(argv = process.argv.slice(2)) {
     console.log('  server/src/app.module.ts (see its comment block). Before production, read the');
     console.log('  README "Production requirements" (emailSender, link URLs, NODE_ENV, TRUST_PROXY,');
     console.log('  migrations).');
+    if (captcha.provider !== null) {
+        console.log(`\n  CAPTCHA: ${captcha.provider}. CAPTCHA_PROVIDER (server/.env.example) and`);
+        console.log('  VITE_CAPTCHA_PROVIDER (frontend/.env.example) are set to the same value; copy');
+        console.log('  them to .env, fill CAPTCHA_SITE_KEY, CAPTCHA_SECRET (a secret-ref:) and');
+        console.log("  CAPTCHA_EXPECTED_HOSTNAMES, and pass ShieldModule.forRoot({ captcha: 'env' }).");
+        if (!withFrontend) {
+            console.log(`  Adding a frontend later? Set VITE_CAPTCHA_PROVIDER=${captcha.provider} there too.`);
+        }
+    }
     console.log('\nNext steps:');
     console.log(`  cd ${appName}/server`);
     console.log('  npm install');

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,gGAAgG;AAChG,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW;IACzB,yEAAyE;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,wDAAwD,IAAI,GAAG,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,+DAA+D,IAAI,GAAG,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,wCAAwC,IAAI,GAAG,CAAC;IACzD,CAAC;IACD,gDAAgD;IAChD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,mEAAmE,IAAI,GAAG,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,KAAK,GAAG;IACZ,mDAAmD;IACnD,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,iBAAiB;IACjB,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,EAAE;IACF,UAAU;IACV,gCAAgC;IAChC,gDAAgD;CACjD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAQb;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAAe,EACf,QAAgB,EAChB,OAAe,EACf,MAAkB,EAClB,GAAW;IAEX,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,2DAA2D;QAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7E,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,OAAe,EACf,OAAe,EACf,MAAkB,EAClB,OAAO,GAAG,EAAE;IAEZ,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAE1D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QAED,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,CACL,4DAA4D,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAU,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAe,EACf,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,YAAY,GAAG,KAAK;IAEpB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAExD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,iCAAiC,CAAC,CAAC;QACvE,CAAC;QACD,6EAA6E;QAC7E,+EAA+E;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,4EAA4E;IAC5E,oEAAoE;IACpE,wEAAwE;IACxE,4CAA4C;IAC5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAK,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE7F,wEAAwE;IACxE,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CACV,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAC3B,OAAO,EACP,MAAM,EACN,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAc;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAEvD,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,sBAAsB,eAAe,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAI,IAAe,CAAC,IAAI,EAAE,CAAC;IAExC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sDAAsD;IACtD,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,qDAAqD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IACzF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE9B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,SAAS,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9F,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,WAAW,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;IACvD,CAAC;AACH,CAAC;AACD,IAAI,cAAc,EAAE,EAAE,CAAC;IACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,gGAAgG;AAChG,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW;IACzB,yEAAyE;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,wDAAwD,IAAI,GAAG,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,+DAA+D,IAAI,GAAG,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,wCAAwC,IAAI,GAAG,CAAC;IACzD,CAAC;IACD,gDAAgD;IAChD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,mEAAmE,IAAI,GAAG,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,CAAU,CAAC;AAGxF,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAuB;IAEvB,IAAI,KAAyB,CAAC;IAC9B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,GAAG,IAAI,CAAC;YACZ,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,mBAAmB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6BAA6B,KAAK,iBAAiB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;SACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;IACZ,0EAA0E;IAC1E,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,iBAAiB;IACjB,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,4EAA4E;IAC5E,8EAA8E;IAC9E,gEAAgE;IAChE,oEAAoE;IACpE,EAAE;IACF,UAAU;IACV,gCAAgC;IAChC,gDAAgD;IAChD,oEAAoE;CACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAQb;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAAe,EACf,QAAgB,EAChB,OAAe,EACf,MAAkB,EAClB,GAAW;IAEX,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,2DAA2D;QAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7E,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,OAAe,EACf,OAAe,EACf,MAAkB,EAClB,OAAO,GAAG,EAAE;IAEZ,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAE1D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QAED,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,CACL,4DAA4D,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAU,CAAC;AAQ1D;;;;GAIG;AACH,MAAM,iBAAiB,GAAG;IACxB,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACxD,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE;CACvD,CAAC;AAEX,SAAS,oBAAoB,CAC3B,SAAiB,EACjB,MAAkB,EAClB,QAAyB;IAEzB,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,iBAAiB,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,cAAc,IAAI,gBAAgB,CAAC,CAAC;QACrE,CAAC;QACD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAe,EACf,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,YAAY,GAAG,KAAK,EACpB,UAA2B,EAAE;IAE7B,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IACxD,IAAI,eAAe,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,eAAe,CAAC,iBAAiB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAExD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,iCAAiC,CAAC,CAAC;QACvE,CAAC;QACD,6EAA6E;QAC7E,+EAA+E;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,4EAA4E;IAC5E,oEAAoE;IACpE,wEAAwE;IACxE,4CAA4C;IAC5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAK,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE7F,wEAAwE;IACxE,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CACV,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAC3B,OAAO,EACP,MAAM,EACN,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAc;IAClC,iFAAiF;IACjF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;AACtF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,sBAAsB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,sBAAsB,eAAe,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAI,IAAe,CAAC,IAAI,EAAE,CAAC;IAExC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE;YAC3D,eAAe,EAAE,OAAO,CAAC,QAAQ;SAClC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sDAAsD;IACtD,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,qDAAqD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IACzF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,QAAQ,8CAA8C,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CACT,wDAAwD,OAAO,CAAC,QAAQ,aAAa,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,SAAS,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9F,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,WAAW,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;IACvD,CAAC;AACH,CAAC;AACD,IAAI,cAAc,EAAE,EAAE,CAAC;IACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-astram-app",
-  "version": "0.11.1",
+  "version": "0.12.1",
   "license": "MIT",
   "description": "Scaffolder for a new Astram app — emits a running, framework-enforced NestJS server (deny-by-default, built-in auth/identity to switch on) and, with --with-frontend, a React admin/auth UI, over the immutable @astram/* framework packages.",
   "type": "module",

package/template/frontend/_env.example

@@ -4,3 +4,10 @@
 # VITE_APP_LOGO_DARK=/my-logo-dark.png
 # VITE_APP_TAGLINE=...
 # VITE_APP_SUB_TAGLINE=...
+#
+# CAPTCHA provider this build allows in its Content-Security-Policy: turnstile | recaptcha-v3 |
+# recaptcha-v2, or unset for none (index.html unchanged). It MUST equal the server's
+# CAPTCHA_PROVIDER (server/.env); a mismatch shows a "misconfigured" notice on the login page.
+# Read at build time (`npm run build`), so rebuild after changing it. No key goes here: the site
+# key comes from the server at run time.
+# VITE_CAPTCHA_PROVIDER=turnstile

package/template/frontend/package.json

@@ -12,8 +12,8 @@
     "test": "node scripts/run-tests.mjs"
   },
   "dependencies": {
-    "@astram/frontend-core": "^0.6.1",
-    "@astram/sdk": "^0.2.0",
+    "@astram/frontend-core": "^0.8.0",
+    "@astram/sdk": "^0.2.1",
     "@radix-ui/react-alert-dialog": "^1.1.19",
     "@radix-ui/react-avatar": "^1.1.10",
     "@radix-ui/react-checkbox": "^1.1.4",

package/template/frontend/src/App.jsx

@@ -27,6 +27,7 @@ import TwoFactorPage from './pages/account/TwoFactorPage';
 import ReenrollPage from './pages/account/ReenrollPage';
 import CompaniesPage from './pages/companies/CompaniesPage';
 import CompanyForm from './pages/companies/CompanyForm';
+import OrgStructurePage from './pages/org-structure/OrgStructurePage';
 import RolesPage from './pages/roles/RolesPage';
 import RoleForm from './pages/roles/RoleForm';
 import UsersPage from './pages/users/UsersPage';
@@ -39,6 +40,7 @@ import ServiceAccountsPage from './pages/service-accounts/ServiceAccountsPage';
 import GrantsPage from './pages/cross-tenant/GrantsPage';
 import GrantForm from './pages/cross-tenant/GrantForm';
 import InboxPage from './pages/cross-tenant/InboxPage';
+import SecuritySettingsPage from './pages/security/SecuritySettingsPage';
 
 /** Only-when-signed-out (auth screens bounce authenticated users to the app). */
 function PublicOnly({ children }) {
@@ -192,6 +194,17 @@ export default function App() {
         <Route path="add" element={<CompanyForm />} />
         <Route path="edit/:uuid" element={<CompanyForm />} />
       </Route>
+      {/* Org structure (G-012) — a company's departments and branches. Gated like the nav
+          entry (`identity:company_department:read`; `gate` takes one key); add, rename and
+          delete are department|branch:create|update|delete, enforced server-side. */}
+      <Route
+        path="/org-structure"
+        element={
+          <RequireAuth gate="identity:company_department:read">
+            <OrgStructurePage />
+          </RequireAuth>
+        }
+      />
       <Route
         path="/roles"
         element={
@@ -278,6 +291,17 @@ export default function App() {
           </RequireAuth>
         }
       />
+      {/* Security settings (auth capabilities R13.4) — mandatory-2FA policies. Gated
+          identity:security_policy:read (security-policy.controller.ts `GET security-policies`);
+          add/edit/delete are security_policy:create|update|delete, enforced server-side. */}
+      <Route
+        path="/security"
+        element={
+          <RequireAuth gate="identity:security_policy:read">
+            <SecuritySettingsPage />
+          </RequireAuth>
+        }
+      />
       <Route path="*" element={<Navigate to="/dashboard" replace />} />
     </Routes>
   );

package/template/frontend/src/auth/AuthContext.jsx

@@ -19,6 +19,7 @@ import {
   createIdentityService,
   createRecordPolicyService,
   createRecordShareService,
+  createSecurityPolicyService,
   createServiceAccountService,
   createRefreshingHttp,
   isAuthenticated,
@@ -28,7 +29,13 @@ import { createWebHttpClient } from '../platform/httpClient';
 import { createWebSessionStore } from '../platform/sessionStore';
 import { createWebShieldTransport } from '../platform/shieldTransport';
 import { saveReturnPath } from '../platform/returnPathStore';
-import { establishSession as runEstablishSession } from './sessionFlow';
+import {
+  afterDeviceConfirmed,
+  clearSessionViews,
+  crossTabChange,
+  establishSession as runEstablishSession,
+  factsScopeOf,
+} from './sessionFlow';
 
 const AuthContext = createContext(null);
 
@@ -39,15 +46,20 @@ export function AuthProvider({ children }) {
   // so the router re-renders. Until a fresh device is confirmed, the app forces the
   // re-enroll screen (§4). Set on either (a) a `mfaRecoveryUsed:true` login result, or
   // (b) the app-wide 403 `reenrollment_required` interceptor catching a blocked request.
+  // R2.3: a policy that requires 2FA restricts the session the same way (`mfa_enrollment`);
+  // `restrictionReason` lets the enrolment screen word its heading per reason.
   const [mustReenroll, setMustReenroll] = useState(false);
+  const [restrictionReason, setRestrictionReason] = useState(null);
   const reenrollRef = useRef(false);
-  const markReenroll = () => {
+  const markReenroll = (reason = 'reenroll') => {
     if (reenrollRef.current) return; // already flagged — avoid redundant re-renders
     reenrollRef.current = true;
+    setRestrictionReason(reason);
     setMustReenroll(true);
   };
   const clearReenroll = () => {
     reenrollRef.current = false;
+    setRestrictionReason(null);
     setMustReenroll(false);
   };
 
@@ -70,7 +82,8 @@ export function AuthProvider({ children }) {
     // `{ error: 'reenrollment_required' }` (the enforced-re-enroll gate, §4) flips the
     // app into the forced re-enroll flow. Matched narrowly so a future permission-deny
     // 403 never triggers it.
-    const rawHttp = createWebHttpClient({ onReenrollRequired: () => markReenroll() });
+    // R2.3: `mfa_enrollment_required` (and the restricted auth-facts answer) route the same way.
+    const rawHttp = createWebHttpClient({ onRestricted: (reason) => markReenroll(reason) });
     const store = createWebSessionStore();
     // Token refresh (#12): every service talks through `http`, which turns a 401 on a
     // request that carried a bearer token into ONE shared refresh (single-flight, and a
@@ -96,6 +109,8 @@ export function AuthProvider({ children }) {
       // The guided rule-builder surface (§9.1) — author/list/delete record-access policies +
       // the field/operator schema that drives the builder's dropdowns.
       recordPolicy: createRecordPolicyService(http),
+      // 2FA security policies (R2): the Security settings page.
+      securityPolicy: createSecurityPolicyService(http),
       // The owner-share surface (§9.2) — share/unshare/list a record's shares (owner-only).
       recordShare: createRecordShareService(http),
       // Service accounts (ADR-0033) — list/create/edit machine accounts + issue/rotate/revoke
@@ -104,6 +119,8 @@ export function AuthProvider({ children }) {
       account: createAccountService(http),
       // The @astram/sdk ShieldClient (Phase E slice 1) — a UX-convenience projection of
       // the caller's OWN coarse grants, fetched once per session via `getAuthFacts`.
+      // Built once, so every session boundary calls `shield.reset()` (establishSession,
+      // resetSessionViews) and every fetch is scoped to its session (KI #139).
       // NEVER the security boundary: the server's decide() on every @Classified route
       // is the real enforcement (see shieldTransport.js's header doc). `getToken` reads
       // `tokenRef.current` (not a closed-over value) so the SAME client instance always
@@ -126,6 +143,7 @@ export function AuthProvider({ children }) {
     audit,
     crossTenant,
     recordPolicy,
+    securityPolicy,
     recordShare,
     serviceAccounts,
     account,
@@ -159,12 +177,15 @@ export function AuthProvider({ children }) {
     store.save(value);
   };
 
-  // Everything derived from a session that must not outlive it.
-  const resetSessionViews = () => {
-    setProfile(null);
-    setAuthFacts(null); // fail-closed: no session -> no cached facts to (mis)trust
-    clearReenroll();
-  };
+  // Everything derived from a session that must not outlive it, including the ShieldClient's
+  // cached projection (KI #139). Sign-out, expiry and a cross-tab session change all run this.
+  const resetSessionViews = () =>
+    clearSessionViews({
+      resetShield: () => shield.reset(),
+      setProfile,
+      setAuthFacts,
+      clearReenroll,
+    });
 
   // Wire the refreshing http client's lifecycle callbacks (the client is built once above;
   // these run only after a network round-trip, so binding them in an effect is early enough).
@@ -216,14 +237,16 @@ export function AuthProvider({ children }) {
   // RESOLVED projection, never reset to `null` mid-poll. `principalId` absent (no
   // session yet) → skip, leaving `authFacts` at its fail-closed `null` (useCan
   // hides/denies until known).
-  const refreshAuthFacts = async (principalId) => {
+  // `scope` (tenant + session, from factsScopeOf) keys the SDK's projection cache, so a
+  // projection cached for another session or tenant is never served here (KI #139).
+  const refreshAuthFacts = async (principalId, scope) => {
     if (!principalId) {
       setAuthFacts(null);
       return;
     }
     let projection;
     try {
-      projection = await shield.getAuthFacts(principalId);
+      projection = await shield.getAuthFacts(principalId, scope);
     } catch {
       projection = null; // getAuthFacts is documented never to throw; belt and braces
     }
@@ -243,6 +266,7 @@ export function AuthProvider({ children }) {
     runEstablishSession(
       { session, tokens, identityHint },
       {
+        resetShield: () => shield.reset(),
         persist,
         setCurrentToken: (token) => {
           tokenRef.current = token;
@@ -252,8 +276,20 @@ export function AuthProvider({ children }) {
       },
     );
 
-  const login = async (identityHint, password) => {
-    const r = await auth.login(identityHint, password);
+  // A device was confirmed (Two-factor page, or the re-enroll screen): refetch the auth facts
+  // (after a ShieldClient reset) and the profile, then lift any restriction (sessionFlow.js).
+  // Without this the nav stayed denied and the grace banner stayed until the 60 s poll.
+  const deviceConfirmed = () =>
+    afterDeviceConfirmed({
+      resetShield: () => shield.reset(),
+      refreshAuthFacts: () => refreshAuthFacts(principalOf(state), factsScopeOf(state?.session)),
+      loadProfile: () => loadProfile(state?.tokens?.accessToken),
+      clearRestriction: clearReenroll,
+    });
+
+  // `opts.captchaToken` (R7.3): sent when the login page has a solved CAPTCHA.
+  const login = async (identityHint, password, opts) => {
+    const r = await auth.login(identityHint, password, opts);
     if (r.ok === true) {
       await establishSession(r.session, r.tokens, identityHint);
     }
@@ -284,12 +320,10 @@ export function AuthProvider({ children }) {
   };
 
   const logout = async () => {
-    const sessionId = state?.session?.sessionId;
+    const held = state; // { session, tokens }: the server needs a token as proof (R15.1)
     persist(null); // clear locally first — the UI must never wait on the server
-    setProfile(null);
-    setAuthFacts(null); // fail-closed: no session -> no cached facts to (mis)trust
-    clearReenroll(); // a fresh sign-in starts unrestricted
-    await rawAuth.logout(sessionId); // raw client: no refresh/expiry path on a logout
+    resetSessionViews(); // profile, facts, restriction flags and the ShieldClient cache
+    await rawAuth.logout(held); // raw client: no refresh/expiry path on a logout
   };
 
   // On mount (e.g. a page refresh that rehydrated a persisted session), fetch the
@@ -298,7 +332,9 @@ export function AuthProvider({ children }) {
   useEffect(() => {
     const token = state?.tokens?.accessToken;
     if (token && profile === null) void loadProfile(token);
-    if (token && authFacts === null) void refreshAuthFacts(principalOf(state));
+    if (token && authFacts === null) {
+      void refreshAuthFacts(principalOf(state), factsScopeOf(state?.session));
+    }
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
@@ -310,14 +346,12 @@ export function AuthProvider({ children }) {
       store.subscribe((next) => {
         const prevSessionId = sessionIdRef.current;
         setState(next);
-        if (!next) {
-          resetSessionViews();
-          return;
-        }
-        if (next.session?.sessionId !== prevSessionId) {
-          resetSessionViews();
+        const change = crossTabChange(prevSessionId, next);
+        if (change === 'rotated') return; // same session, new tokens: keep the views
+        resetSessionViews(); // signed out or a different sign-in: drop this session's views
+        if (change === 'switched') {
           void loadProfile(next.tokens?.accessToken);
-          void refreshAuthFacts(principalOf(next));
+          void refreshAuthFacts(principalOf(next), factsScopeOf(next.session));
         }
       }),
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -346,8 +380,9 @@ export function AuthProvider({ children }) {
     if (!token) return undefined; // not authenticated — nothing to keep fresh
 
     const principalId = principalOf(state);
+    const scope = factsScopeOf(state?.session);
     const poke = () => {
-      if (principalId) void refreshAuthFacts(principalId);
+      if (principalId) void refreshAuthFacts(principalId, scope);
     };
 
     const onFocus = () => poke();
@@ -363,7 +398,7 @@ export function AuthProvider({ children }) {
     // Re-armed whenever the token/principal changes (login/logout/refresh) so a stale
     // closure never keeps polling for a signed-out or since-replaced session.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [state?.tokens?.accessToken, state?.session?.principalId]);
+  }, [state?.tokens?.accessToken, state?.session?.principalId, state?.session?.sessionId]);
 
   const value = useMemo(
     () => ({
@@ -380,9 +415,13 @@ export function AuthProvider({ children }) {
       // True while the current session is restricted to re-securing the account
       // (recovery-code login). The router forces the re-enroll screen until cleared.
       mustReenroll,
-      // Clear the restriction — called by the re-enroll screen after a device confirm
-      // succeeds (the server has already flipped the bound claim; this releases the UI).
+      // Why the session is restricted: 'reenroll' | 'mfa_enrollment' | null (R2.3).
+      restrictionReason,
+      // Clear the restriction locally (no refetch). A device confirm uses deviceConfirmed.
       clearReenroll,
+      // After a device confirm: refetch facts + profile, then lift the restriction (the server
+      // has already lifted it on this token). Awaited by TwoFactorPage before its callback.
+      deviceConfirmed,
       login,
       // Complete a pending MFA challenge (second factor) — same session-establish
       // path as login. Consumed by the Login page's MFA code step.
@@ -402,6 +441,8 @@ export function AuthProvider({ children }) {
       // The shared guided rule-builder service (author/list/delete record policies + the
       // field/operator schema) — same injected web http client.
       recordPolicy,
+      // The 2FA security-policy service (Security settings page) — same client.
+      securityPolicy,
       // The shared owner-share service (share/unshare/list a record's shares) — same client.
       recordShare,
       // The shared service-accounts service (list/create/edit + issue/rotate/revoke keys).
@@ -438,12 +479,14 @@ export function AuthProvider({ children }) {
       audit,
       crossTenant,
       recordPolicy,
+      securityPolicy,
       recordShare,
       serviceAccounts,
       account,
       shield,
       profile,
       mustReenroll,
+      restrictionReason,
       authFacts,
     ],
   );